Audit commercial resilience claim integrity

Audit resilience ROI claims against a unique commercial-source to technical-component graph: recompute each action's avoided loss under joint failure scenarios, cap support at graph-derived value, detect duplicate effects, probability drift and weak evidence, and prevent overlapping component benefits from being sold twice.

What it's for

Stops architecture and reliability business cases from adding the same contract or revenue exposure once per component, while showing exactly which claims need finance or evidence repair.

What you give it

Inputs split into evidence read from your connected systems, calibration your team owns, and numerical controls that affect precision but never the result's meaning.

Field Type Role Required
action_effects array of objects (5 fields) ≥ 1 item Evidence Yes
commercial_sources array of objects (3 fields) ≥ 1 item Evidence Yes
components array of objects (2 fields) ≥ 1 item Evidence Yes
exposure_edges array of objects (5 fields) ≥ 1 item Evidence Yes
max_detail_rows integer ≥ 1, ≤ 500 Numerical control Optional
maximum_claim_overstatement_fraction number ≥ 0, ≤ 1 Your calibration Optional
maximum_probability_sum_error number ≥ 0, ≤ 1 Your calibration Optional
minimum_evidence_coverage number ≥ 0, ≤ 1 Your calibration Optional
resilience_actions array of objects (7 fields) ≥ 1 item Evidence Yes
scenarios array of objects (4 fields) ≥ 2 items Evidence Yes

Each resilience_actions record

Field Type Required
capacity_units number (≥ 0) Yes
claimed_avoided_loss_scenarios array of number (≥ 2 items) Yes
cost number (≥ 0) Yes
dependency_ids array of string Yes
evidence_verified boolean Yes
exclusion_ids array of string Yes
id string (non-empty) Yes
Example input
{
  "action_effects": [
    {
      "action_id": "harden-api",
      "component_id": "api",
      "evidence_verified": true,
      "id": "harden-api-effect",
      "residual_loss_multipliers": [
        0.2,
        0.2,
        0.2,
        0.2
      ]
    },
    {
      "action_id": "harden-database",
      "component_id": "database",
      "evidence_verified": true,
      "id": "harden-database-effect",
      "residual_loss_multipliers": [
        0.5,
        0.5,
        0.5,
        0.5
      ]
    }
  ],
  "commercial_sources": [
    {
      "evidence_verified": true,
      "id": "enterprise-contract",
      "value_at_risk": 100
    },
    {
      "evidence_verified": true,
      "id": "usage-margin",
      "value_at_risk": 200
    }
  ],
  "components": [
    {
      "evidence_verified": true,
      "id": "api"
    },

Truncated for display — the full payload is 136 lines.

What you get back

This is the actual output of running the example above — computed by the same function the platform calls, not an illustration.

Example output
{
  "action_diagnostics": [
    {
      "action_id": "harden-api",
      "claim_overstatement_fraction": 0,
      "effect_count": 1,
      "evidence_verified": true,
      "expected_claim_overstatement": 0,
      "expected_claimed_avoided_loss": 20,
      "expected_graph_modeled_avoided_loss": 20,
      "expected_supported_claim": 20,
      "failed_gates": []
    },
    {
      "action_id": "harden-database",
      "claim_overstatement_fraction": 0,
      "effect_count": 1,
      "evidence_verified": true,
      "expected_claim_overstatement": 0,
      "expected_claimed_avoided_loss": 35,
      "expected_graph_modeled_avoided_loss": 35,
      "expected_supported_claim": 35,
      "failed_gates": []
    }
  ],
  "assumptions": [
    "Every commercial source is a unique finance-governed contribution, penalty, relationship or cash exposure on one horizon; source-component fractions represent incremental loss conditional on component failure and combine as retained-value survival rather than additive credits.",
    "Action effects are prospective residual-loss multipliers with point-in-time evidence. The audit recomputes each action alone and caps supported claims at graph-modeled avoided loss; it does not establish causal effectiveness or add standalone claims into a portfolio benefit.",
    "A failed audit requires source, architecture, scenario or effect reconciliation. It is not evidence of fraud, customer quality, engineering blame, vendor misconduct or individual performance and does not authorize investment or personnel action."
  ],
  "configuration": {
    "maximum_claim_overstatement_fraction": 0.05,
    "maximum_probability_sum_error": 0,
    "minimum_evidence_coverage": 0.95,
    "multi_action_effect_rule": "multiplicative_residual_loss",
    "multi_component_loss_rule": "multiplicative_survival_union",
    "scenario_probability_sum": 1
  },
  "decision": "commercial_resilience_claims_supported",
  "duplicate_action_component_pairs": [],
  "method": "unique_source_graph_resilience_claim_integrity_audit_v1",
  "summary": {
    "action_count": 2,
    "commercial_source_count": 2,

Truncated for display — the full payload is 58 lines.

How it works

Network & dependency analysis — Trace how load, failure and knowledge propagate through a graph of teams, services or components.

  1. 1 Freeze unique finance-owned commercial sources, technical components, conditional-loss exposure edges and coherent joint failure scenarios on one point-in-time decision horizon.
  2. 2 Apply every proposed action alone through its scenario-aligned residual-loss multipliers, combine simultaneous component failures as a multiplicative retained-value union, and compare the resulting avoided loss with the submitted claim.
  3. 3 Cap supported value at graph-modeled avoided loss, retain overstatement, duplicate action-component effects, probability error and evidence gaps, and abstain unless every governed gate clears.

Before you trust it

Every tool in the catalog ships with the conditions under which its answer is meaningful — and the conditions under which it should abstain instead of guessing.

Assumptions & guardrails

  • Nodes, edges, direction, time window, missing-link policy, and aggregation boundary represent the coordination or dependency mechanism of interest.
  • Commercial sources are unique, exposure fractions and action effects are prospective and point-in-time, scenarios preserve common modes, and value/cost/horizon definitions are comparable.
  • Structural centrality, fragility, or clustering describes a modeled graph and must not be interpreted as intent, guilt, or personal value.
  • Supported arithmetic is not causal proof, legal interpretation, availability assurance, investment authority or evidence about a named worker, customer or vendor.

Minimum evidence

  • commercial_sources: at least 1 rows/items
  • components: at least 1 rows/items
  • exposure_edges: at least 1 rows/items
  • scenarios: at least 2 rows/items
  • resilience_actions: at least 1 rows/items
  • action_effects: at least 1 rows/items

How to validate it

Validate on held-out periods or aggregate units, perturb edge definitions and missing links, and report sensitivity to graph construction before using structural rankings.

Calibrating it to your org

Same for everyone

The mathematical kernel, validation rules, method version, and JSON output semantics are organization-independent; no tenant-trained coefficients or company benchmark is embedded in the function.

Specific to you

  • tenant-scoped versioned commercial-to-technical exposure graph joined to prospective action-effect claims and a frozen common failure-scenario set without expanding one commercial source into one value row per component
  • commercial source uniqueness and value perimeter, component boundary, conditional-loss semantics, scenario horizon/probability/common-mode coverage, action-effect identification, evidence policy, overstatement/evidence/probability gates, pseudonymization and accountable finance/architecture/SRE/product/legal owners

Calibration workflow

  1. 1 Define the management decision, target outcome, aggregate unit, privacy boundary, cadence, and prediction/intervention horizon for this organization.
  2. 2 Build a tenant-scoped historical cohort using only information available before each prediction or decision; preserve zero periods, censoring, assignment probabilities, and unresolved outcomes when the method requires them.
  3. 3 Estimate statistical parameters on training history, but obtain costs, utilities, risk tolerance, practical-effect thresholds, capacity, and policy constraints from accountable decision owners.
  4. 4 Validate on later time windows or held-out aggregate units at the deployment grain, against a simple baseline and the function-specific validation strategy.
  5. 5 Deploy only if the returned decision clears evidence, overlap, calibration, robustness, and guardrail checks; warning, unsupported, schema-gap, and fallback decisions are abstentions.
  6. 6 Monitor realized outcomes, data drift, coverage, and decision regret; recalibrate at a governed cadence or after a detected regime/definition change, never merely because a stakeholder dislikes the result.

Call it from your AI

You don't wire up 388 tools in your MCP client. The GitRevio MCP server exposes 18 tools, three of which let an agent search the catalog, read a tool's schema, and run it — so the assistant finds this one on its own.

gitrevio_capabilities_search
  { "q": "audit resilience roi claims against a" }
  → finds "audit_commercial_resilience_claim_integrity"

gitrevio_capability_describe
  { "capability_id": "audit_commercial_resilience_claim_integrity" }
  → returns the input schema and agent guidance shown on this page

gitrevio_capability_run
  { "capability_id": "audit_commercial_resilience_claim_integrity", "arguments": { ... } }
  → returns the result shown above

Works in Claude Desktop, Claude Code, Cursor, Cline, Continue.dev, Goose and Aider. See the MCP server.

Related tools

Attribute commercial dependency tail loss

Calculate expected loss, VaR and CVaR for commercial value concentrated in shared technical components, then allocate every modeled tail-loss dollar exactly once across components with normalized negative-log survival hazard rather than overlapping leave-one-out sensitivities.

Forecasting & survival

Optimize commercial resilience portfolio

Select a budgeted, capacity-feasible technical resilience portfolio directly on a deduplicated commercial exposure graph, combining simultaneous failures and multiple mitigations multiplicatively, enforcing CVaR and critical-loss gates, returning a cost-loss-tail Pareto frontier, and disclosing exact or deterministic beam search.

Network & dependency analysis

Aggregate risk register copula

Aggregate risk-register occurrence and lognormal severity marginals through a validated Gaussian copula into expected loss, VaR, CVaR, dependence amplification, and tail shares.

Statistical audit & measurement

Allocate restless bandit interventions

Allocate scarce recurring interventions across evolving Markov units with Whittle indices, explicit indexability checks, and paired policy simulation.

Sequential Bayesian & bandits

Audit decision rank robustness smaa

Measure rank acceptability, regret, pairwise dominance, and central winning weights under uncertain criterion scores and bounded stakeholder weights.

Statistical audit & measurement

Audit extreme metric tail dependence

Detect extreme metric co-exceedances beyond independence with empirical tail coefficients, permutation inference, practical magnitude gates, and FDR control.

Statistical audit & measurement

See every tool in Risk, tails & resilience →

Ready to See Your Engineering work clearly?

Request a free demo